Event and PerformanceMark: the user-timing and DOM defects the corpus found

[lahma]

Fixes items 1, 2 and 3 of #3212 — the user-timing and DOM Event defects. With #3243 (items 4–6) that leaves four of the eleven; #3212 stays open.

Two of the three recorded analyses were wrong, and both corrections are in the docs rather than quietly worked around.

---

Item 1 — PerformanceMark options

The issue says performance.mark(name, 123) "refuses it correctly", so the two halves of mark-errors.any.js disagree. They did not disagree. mark-errors.any.js calls the method unbound (testInfo.testFunction(self.performance.mark)), so the TypeError its passing half observed came from the brand check on a this of undefined — not from any conversion. performance.mark(name, 123) did not refuse a non-object either.

Both halves already shared one conversion, UserTiming.ReadMarkOptions (reached through PerformanceMarkConstructor.ReadArguments, which performance.mark runs as its own step 1), and it treated every non-object as the empty dictionary. Fixed in that shared path per WebIDL §3.2.19 step 1 — "If jsDict is not an Object and jsDict is neither undefined nor null, then throw a TypeError" — which is exactly what EventConstructor.ReadEventInit already did.

Item 2 — isTrusted, and its allocation cost

DOM declares it [LegacyUnforgeable]; WebIDL §3.4.10 makes that "non-configurable and … an own property on the object itself rather than on its prototype", and §3.7.6 both gives it {[[Set]]: undefined, [[Enumerable]]: true, [[Configurable]]: false} and removes it from the prototype. Implemented as a virtual own property — the shape Function already uses for length/name and JsError for message.

The per-instance cost is zero, which is not the obvious outcome and was measured rather than asserted (GC.GetAllocatedBytesForCurrentThread, 20,000 iterations, best of 7, net10.0, engine reverted to main for the before column):

workload	before	after
new Event('x')	112 B	112 B
new CustomEvent('x')	120 B	120 B
new Event('x'); e.isTrusted	112 B	112 B
t.dispatchEvent(new Event('x'))	192 B	192 B
Object.getOwnPropertyDescriptor(e,'isTrusted')	112 B	616 B

Nothing per instance and nothing per read. The only row that moved is the descriptor query, which previously returned undefined; the 504 B is ECMAScript's own FromPropertyDescriptor result — what any accessor costs.

Worth stating because the naive implementation is not free: one stored own property on an event measures 296 B against 112 B — +184 B, +164%. Two things buy the zero: the descriptor is one shared instance per realm (an accessor is unwrapped by calling its getter with the receiver), and it is never stored. Sharing is safe by the argument the engine already makes process-wide for AllForbiddenDescriptor — a non-configurable, setter-less descriptor is unreachable by every mutating branch of ValidateAndApplyPropertyDescriptor.

Behaviour that changed for every event, and is the point: Object.keys(new Event('x')) is now ["isTrusted"] and JSON.stringify gives {"isTrusted":false}, as a browser answers. One existing test asserted the old count and was updated.

Item 3 — srcElement and returnValue

The recorded analysis called srcElement [LegacyUnforgeable]. Re-deriving from the interface IDL shows it carries no extended attribute — only isTrusted does — so it is an ordinary prototype accessor returning this's target.

returnValue is implemented as the algorithm, not a field: the getter is !canceledFlag and the setter runs set the canceled flag, so it is preventDefault() under another name — ignored by a non-cancelable event and inside a passive listener, and = true never clears a flag already set. Its IDL type is boolean, so = 0 cancels and = 1 does not.

Event-constructors.any.js — vendored, but it needed a third member

Items 2 and 3 did not make it vendorable, and the recorded reason was incomplete: each of its two unnamed failures asserts the whole initial state of a new event, assert_true("initEvent" in ev) included, so fixing srcElement/returnValue left it failing one assertion later.

initEvent() and initCustomEvent() are implemented — initialize an event step for step behind the dispatch-flag guard, deliberately not touching the composed flag — and the file is vendored. Its "set the initialized flag" step has nothing to set here: that flag is unset only by document.createEvent() and read only by dispatchEvent's InvalidStateError guard, and there is no document.

Byte-verified: git hash-object of the vendored copy is faa623ea92991b72742477a18471449f5382f1a8, the blob id GitHub reports for that path at the pin. Minimum-test floor 14 — the file has 14 tests, not the 15 the old prose claimed. All 14 pass.

This is beyond the three items and is its own commit, so it can be dropped without touching the rest.

Exclusion accounting

NeedsTriage 29 → 23 rows: 4 × mark-errors.any.js, Event-isTrusted.any.js, AddEventListenerOptions-passive.any.js. _notVendored loses its Event-constructors.any.js row. The NeedsTriage doc comment and three Vendor/README.md sections were rewritten to match.

Verification

Solution builds Release, 0 errors. All production changes are under Jint/WebApi/.

suite	net472	net10.0
Jint.Tests	7147	10234
Jint.Tests + JINT_HOST_CONTRACT_VERIFICATION=1	7147	10234
Jint.Tests.PublicInterface	1879	2405
Jint.Tests.PublicInterface + verification	1883	2409

WPT 417/417 files. Per-row before/after with only the engine reverted — exactly 8 rows moved, all FAIL→PASS, all intended: dom/events 37/4 → 41/0, user-timing 69/9 → 73/5, and every other corpus (dom/abort, hr-time, html/*, fetch/api/*, streams, workers, WebCryptoAPI, encoding, url, urlpattern, FileAPI, compression) byte-identical.

test262 not run: nothing reaches non-web-API engine code — the ObjectInstance virtuals are overridden only on JsEvent, which test262 never creates.

Left undone

cancelBubble is still absent — the last legacy Event member, not in the issue and needed by no vendored file.

🤖 Generated with Claude Code